Re: [rtcweb] Consensus call regarding media security

[Roman Shpount <[e-mail]>]

On Wed, Mar 28, 2012 at 5:11 PM, Iñaki Baz Castillo <[e-mail]> wrote:

> In all those scenarios you mention, using security (SRTP) is not *bad*, is
> it?
> The fact that in certain scenarios it could be not needed, it does not
> mean that "no security" is better than "security".
>
> I actually think that you are confusing encryption with security. No
encryption often means better security. Bot nets use encryption to
communicate, it does not mean they enable user security. In a lot of cases
ability for the user to check what exactly they are communicating and to
whom is security. As a security conscious person I do not want encrypted
communication from my computer or my network unless I know exactly who it
is going to. If I do not have to I would prefer my communications to be
unencrypted.


> RFC 3711 was created in 2004, 8 years ago!
>
> Which "new" application you mean if it's not capable of implementing a
> simple specification from 2004? how "new" is it? is it really new? or
> is it a "SIP voicemail server" made in 2002?
>
> Well let me list them: FreeSwitch, Asterisk, linphone, etc. All of those
use libsrtp. For all of them SRTP is broken. Not a single one of them
bothered to check or only recently detected problems (
https://issues.asterisk.org/jira/browse/ASTERISK-16665).


>
> Sorry but I still see *no* argument at all in favour of allowing plain
> RTP in WebRTC. And AFAIK there is already consensus about it: plain
> RTP is not allowed.
>
> I do not see an argument why RTP should not be allowed. I think you are
arguing we should require a feature (SRTP) for the sake of requiring a
feature.
_____________
Roman Shpount